claude-code-workflow 6.3.18 → 6.3.19

package/ccw/dist/utils/path-resolver.js

@@ -4,6 +4,7 @@ import { homedir } from 'os';
 import { StoragePaths, ensureStorageDir, LegacyPaths } from '../config/storage-paths.js';
 /**
  * Resolve a path, handling ~ for home directory
+ * Also handles Windows drive-relative paths (e.g., "D:path" -> "D:\path")
  * @param inputPath - Path to resolve
  * @returns Absolute path
  */
@@ -14,6 +15,16 @@ export function resolvePath(inputPath) {
     if (inputPath.startsWith('~')) {
         return join(homedir(), inputPath.slice(1));
     }
+    // Handle Windows drive-relative paths (e.g., "D:path" without backslash)
+    // Pattern: single letter followed by colon, then immediately a non-slash character
+    // This converts "D:path" to "D:\path" to make it absolute
+    if (process.platform === 'win32' || /^[a-zA-Z]:/.test(inputPath)) {
+        const driveRelativeMatch = inputPath.match(/^([a-zA-Z]:)([^/\\].*)$/);
+        if (driveRelativeMatch) {
+            // Insert backslash after drive letter
+            inputPath = driveRelativeMatch[1] + '\\' + driveRelativeMatch[2];
+        }
+    }
     return resolve(inputPath);
 }
 /**
@@ -44,6 +55,19 @@ export function validatePath(inputPath, options = {}) {
         const message = err instanceof Error ? err.message : String(err);
         return { valid: false, path: null, error: `Invalid path: ${message}` };
     }
+    // Check if within base directory when specified (pre-symlink resolution)
+    const resolvedBase = baseDir ? resolvePath(baseDir) : null;
+    if (resolvedBase) {
+        const relativePath = relative(resolvedBase, resolvedPath);
+        // Path traversal detection: relative path should not start with '..'
+        if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+            return {
+                valid: false,
+                path: null,
+                error: `Path must be within ${resolvedBase}`
+            };
+        }
+    }
     // Check if path exists when required
     if (mustExist && !existsSync(resolvedPath)) {
         return { valid: false, path: null, error: `Path does not exist: ${resolvedPath}` };
@@ -59,9 +83,30 @@ export function validatePath(inputPath, options = {}) {
             return { valid: false, path: null, error: `Cannot resolve path: ${message}` };
         }
     }
-    // Check if within base directory when specified
-    if (baseDir) {
-        const resolvedBase = resolvePath(baseDir);
+    else if (resolvedBase) {
+        // For non-existent paths, resolve the nearest existing ancestor to prevent symlink-based escapes
+        // (e.g., baseDir/link/newfile where baseDir/link is a symlink to a disallowed location).
+        let existingPath = resolvedPath;
+        while (!existsSync(existingPath)) {
+            const parent = resolve(existingPath, '..');
+            if (parent === existingPath)
+                break;
+            existingPath = parent;
+        }
+        if (existsSync(existingPath)) {
+            try {
+                const realExisting = realpathSync(existingPath);
+                const remainder = relative(existingPath, resolvedPath);
+                realPath = remainder && remainder !== '.' ? join(realExisting, remainder) : realExisting;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                return { valid: false, path: null, error: `Cannot resolve path: ${message}` };
+            }
+        }
+    }
+    // Check if within base directory when specified (post-symlink resolution)
+    if (resolvedBase) {
         const relativePath = relative(resolvedBase, realPath);
         // Path traversal detection: relative path should not start with '..'
         if (relativePath.startsWith('..') || isAbsolute(relativePath)) {

package/ccw/dist/utils/path-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-resolver.js","sourceRoot":"","sources":["../../src/utils/path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAoBzF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAErC,8BAA8B;IAC9B,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA+B,EAAE;IAC/E,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAExE,6BAA6B;IAC7B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACjE,CAAC;IAED,kBAAkB;IAClB,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAErC,iEAAiE;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACjF,CAAC;IAED,mBAAmB;IACnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,qCAAqC;IACrC,IAAI,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,YAAY,EAAE,EAAE,CAAC;IACrF,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEtD,qEAAqE;QACrE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,uBAAuB,YAAY,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAC7F,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,aAAqB,OAAO,CAAC,GAAG,EAAE;IACvF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAEtC,gCAAgC;IAChC,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IACxF,CAAC;IAED,mBAAmB;IACnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACrF,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,8BAA8B;IAC9B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC5F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC;KAC5C,CAAC;IAEF,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAE7C,kEAAkE;IAClE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;YACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAE7B,oDAAoD;QACpD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;QAErE,eAAe;QACf,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE1B,eAAe;QACf,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAEzC,mCAAmC;QACnC,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;QAEpC,gCAAgC;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;QAErE,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,gDAAgD;YAChD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"path-resolver.js","sourceRoot":"","sources":["../../src/utils/path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAoBzF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAErC,8BAA8B;IAC9B,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,yEAAyE;IACzE,mFAAmF;IACnF,0DAA0D;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACtE,IAAI,kBAAkB,EAAE,CAAC;YACvB,sCAAsC;YACtC,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA+B,EAAE;IAC/E,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAExE,6BAA6B;IAC7B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACjE,CAAC;IAED,kBAAkB;IAClB,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAErC,iEAAiE;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACjF,CAAC;IAED,mBAAmB;IACnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAE1D,qEAAqE;QACrE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,uBAAuB,YAAY,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,YAAY,EAAE,EAAE,CAAC;IACrF,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,iGAAiG;QACjG,yFAAyF;QACzF,IAAI,YAAY,GAAG,YAAY,CAAC;QAChC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,YAAY;gBAAE,MAAM;YACnC,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;gBACvD,QAAQ,GAAG,SAAS,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC3F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEtD,qEAAqE;QACrE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,uBAAuB,YAAY,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAC7F,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,aAAqB,OAAO,CAAC,GAAG,EAAE;IACvF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAEtC,gCAAgC;IAChC,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IACxF,CAAC;IAED,mBAAmB;IACnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACrF,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,OAAO,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,8BAA8B;IAC9B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC5F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC;KAC5C,CAAC;IAEF,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAE7C,kEAAkE;IAClE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;YACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAE7B,oDAAoD;QACpD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;QAErE,eAAe;QACf,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE1B,eAAe;QACf,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAEzC,mCAAmC;QACnC,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;QAEpC,gCAAgC;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;QAErE,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,gDAAgD;YAChD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1D,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/C,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/ccw/dist/utils/path-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/utils/path-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAMhD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,MAAM,EAAE,GAC3B,OAAO,CAQT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CAChB,GACL,OAAO,CAAC,MAAM,CAAC,CAiEjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAEpE"}
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/utils/path-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAMhD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAuBD;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,MAAM,EAAE,GAC3B,OAAO,CAST;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CAChB,GACL,OAAO,CAAC,MAAM,CAAC,CAiEjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAEpE"}

package/ccw/dist/utils/path-validator.js

@@ -6,7 +6,7 @@
  *
  * Inspired by MCP filesystem server's security model.
  */
-import { resolve, isAbsolute, normalize } from 'path';
+import { resolve, isAbsolute, normalize, sep } from 'path';
 import { realpath } from 'fs/promises';
 // Environment variable configuration
 const ENV_PROJECT_ROOT = 'CCW_PROJECT_ROOT';
@@ -35,16 +35,35 @@ export function getAllowedDirectories() {
 export function normalizePath(p) {
     return normalize(p).replace(/\\/g, '/');
 }
+function canonicalizeForComparison(p) {
+    const base = getProjectRoot();
+    const absolute = isAbsolute(p) ? p : resolve(base, p);
+    let canonical = normalize(absolute);
+    // Remove trailing separators (except drive roots like C:\ and posix root /)
+    canonical = canonical.replace(/[\\/]+$/, '');
+    if (/^[a-zA-Z]:$/.test(canonical)) {
+        canonical += sep;
+    }
+    else if (canonical === '') {
+        canonical = sep;
+    }
+    // Windows paths are case-insensitive.
+    if (process.platform === 'win32') {
+        canonical = canonical.toLowerCase();
+    }
+    return canonical;
+}
 /**
  * Check if path is within allowed directories
  */
 export function isPathWithinAllowedDirectories(targetPath, allowedDirectories) {
-    const normalizedTarget = normalizePath(targetPath);
+    const canonicalTarget = canonicalizeForComparison(targetPath);
     return allowedDirectories.some(dir => {
-        const normalizedDir = normalizePath(dir);
-        // Check if path equals or starts with allowed directory
-        return normalizedTarget === normalizedDir ||
-            normalizedTarget.startsWith(normalizedDir + '/');
+        const canonicalDir = canonicalizeForComparison(dir);
+        if (canonicalTarget === canonicalDir)
+            return true;
+        const boundary = canonicalDir.endsWith(sep) ? canonicalDir : canonicalDir + sep;
+        return canonicalTarget.startsWith(boundary);
     });
 }
 /**

package/ccw/dist/utils/path-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-validator.js","sourceRoot":"","sources":["../../src/utils/path-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAU,MAAM,aAAa,CAAC;AAG/C,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAkB,EAClB,kBAA4B;IAE5B,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnC,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,wDAAwD;QACxD,OAAO,gBAAgB,KAAK,aAAa;YAClC,gBAAgB,CAAC,UAAU,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAGI,EAAE;IAEN,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,qBAAqB,EAAE,CAAC;IAE1E,8BAA8B;IAC9B,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,IAAI,CAAC,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,wBAAwB,cAAc,oCAAoC;YAC1E,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvC,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,kCAAkC,cAAc,kCAAkC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,iDAAiD;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,wCAAwC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAEnD,IAAI,CAAC,8BAA8B,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,KAAK,CACb,oCAAoC,gBAAgB,kCAAkC,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,WAAgB,EAAE,CAAC;gBAC1B,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,wEAAwE;oBACxE,qCAAqC;oBACrC,OAAO,YAAY,CAAC;gBACtB,CAAC;gBACD,MAAM,WAAW,CAAC;YACpB,CAAC;YAED,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,gCAAgC;QAChC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAG,YAAsB;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"path-validator.js","sourceRoot":"","sources":["../../src/utils/path-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAY,GAAG,EAAE,MAAM,MAAM,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAU,MAAM,aAAa,CAAC;AAG/C,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAS;IAC1C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,SAAS,IAAI,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAkB,EAClB,kBAA4B;IAE5B,MAAM,eAAe,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnC,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,eAAe,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QAElD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC;QAChF,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAGI,EAAE;IAEN,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,qBAAqB,EAAE,CAAC;IAE1E,8BAA8B;IAC9B,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,IAAI,CAAC,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,wBAAwB,cAAc,oCAAoC;YAC1E,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvC,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,kCAAkC,cAAc,kCAAkC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,iDAAiD;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,wCAAwC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAEnD,IAAI,CAAC,8BAA8B,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,KAAK,CACb,oCAAoC,gBAAgB,kCAAkC,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,WAAgB,EAAE,CAAC;gBAC1B,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,wEAAwE;oBACxE,qCAAqC;oBACrC,OAAO,YAAY,CAAC;gBACtB,CAAC;gBACD,MAAM,WAAW,CAAC;YACpB,CAAC;YAED,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,gCAAgC;QAChC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAG,YAAsB;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC;AACpD,CAAC"}

package/ccw/dist/utils/python-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python-utils.d.ts","sourceRoot":"","sources":["../../src/utils/python-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM9F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAuExC;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAMxE"}
+{"version":3,"file":"python-utils.d.ts","sourceRoot":"","sources":["../../src/utils/python-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM9F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAiFxC;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAMxE"}

package/ccw/dist/utils/python-utils.js

@@ -3,6 +3,15 @@
  * Shared module for consistent Python discovery across the application
  */
 import { execSync } from 'child_process';
+import { EXEC_TIMEOUTS } from './exec-constants.js';
+function isExecTimeoutError(error) {
+    const err = error;
+    const code = err?.code ?? err?.errno;
+    if (code === 'ETIMEDOUT')
+        return true;
+    const message = typeof err?.message === 'string' ? err.message : '';
+    return message.includes('ETIMEDOUT');
+}
 /**
  * Parse Python version string to major.minor numbers
  * @param versionStr - Version string like "Python 3.11.5"
@@ -36,7 +45,7 @@ export function getSystemPython() {
     const customPython = process.env.CCW_PYTHON;
     if (customPython) {
         try {
-            const version = execSync(`"${customPython}" --version 2>&1`, { encoding: 'utf8' });
+            const version = execSync(`"${customPython}" --version 2>&1`, { encoding: 'utf8', timeout: EXEC_TIMEOUTS.PYTHON_VERSION });
             if (version.includes('Python 3')) {
                 const parsed = parsePythonVersion(version);
                 if (parsed && !isPythonVersionCompatible(parsed.major, parsed.minor)) {
@@ -45,8 +54,13 @@ export function getSystemPython() {
                 return `"${customPython}"`;
             }
         }
-        catch {
-            console.warn(`[Python] Warning: CCW_PYTHON="${customPython}" is not a valid Python executable, falling back to system Python`);
+        catch (err) {
+            if (isExecTimeoutError(err)) {
+                console.warn(`[Python] Warning: CCW_PYTHON version check timed out after ${EXEC_TIMEOUTS.PYTHON_VERSION}ms, falling back to system Python`);
+            }
+            else {
+                console.warn(`[Python] Warning: CCW_PYTHON="${customPython}" is not a valid Python executable, falling back to system Python`);
+            }
         }
     }
     // On Windows, try py launcher with specific versions first (3.12, 3.11, 3.10, 3.9)
@@ -54,13 +68,16 @@ export function getSystemPython() {
         const compatibleVersions = ['3.12', '3.11', '3.10', '3.9'];
         for (const ver of compatibleVersions) {
             try {
-                const version = execSync(`py -${ver} --version 2>&1`, { encoding: 'utf8' });
+                const version = execSync(`py -${ver} --version 2>&1`, { encoding: 'utf8', timeout: EXEC_TIMEOUTS.PYTHON_VERSION });
                 if (version.includes(`Python ${ver}`)) {
                     console.log(`[Python] Found compatible Python ${ver} via py launcher`);
                     return `py -${ver}`;
                 }
             }
-            catch {
+            catch (err) {
+                if (isExecTimeoutError(err)) {
+                    console.warn(`[Python] Warning: py -${ver} version check timed out after ${EXEC_TIMEOUTS.PYTHON_VERSION}ms`);
+                }
                 // Version not installed, try next
             }
         }
@@ -70,7 +87,7 @@ export function getSystemPython() {
     let fallbackVersion = null;
     for (const cmd of commands) {
         try {
-            const version = execSync(`${cmd} --version 2>&1`, { encoding: 'utf8' });
+            const version = execSync(`${cmd} --version 2>&1`, { encoding: 'utf8', timeout: EXEC_TIMEOUTS.PYTHON_VERSION });
             if (version.includes('Python 3')) {
                 const parsed = parsePythonVersion(version);
                 if (parsed) {
@@ -86,7 +103,10 @@ export function getSystemPython() {
                 }
             }
         }
-        catch {
+        catch (err) {
+            if (isExecTimeoutError(err)) {
+                console.warn(`[Python] Warning: ${cmd} --version timed out after ${EXEC_TIMEOUTS.PYTHON_VERSION}ms`);
+            }
             // Try next command
         }
     }

package/ccw/dist/utils/python-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"python-utils.js","sourceRoot":"","sources":["../../src/utils/python-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAa;IACpE,iDAAiD;IACjD,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,2DAA2D;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,YAAY,kBAAkB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,iDAAiD,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,oEAAoE,CAAC,CAAC;gBAClK,CAAC;gBACD,OAAO,IAAI,YAAY,GAAG,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,iCAAiC,YAAY,mEAAmE,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC;oBACtC,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,kBAAkB,CAAC,CAAC;oBACvE,OAAO,OAAO,GAAG,EAAE,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpG,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,eAAe,GAA4C,IAAI,CAAC;IAEpE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,GAAG,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,EAAE,CAAC;oBACX,uCAAuC;oBACvC,IAAI,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1D,OAAO,GAAG,CAAC;oBACb,CAAC;oBACD,iDAAiD;oBACjD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,GAAG,CAAC;wBAClB,eAAe,GAAG,MAAM,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,2EAA2E,CAAC,CAAC;QACzK,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QAChH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;AAC1I,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,OAAO;QACL,SAAS;QACT,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"python-utils.js","sourceRoot":"","sources":["../../src/utils/python-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,GAAG,GAAG,KAAsE,CAAC;IACnF,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAa;IACpE,iDAAiD;IACjD,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,2DAA2D;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,YAAY,kBAAkB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC1H,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,iDAAiD,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,oEAAoE,CAAC,CAAC;gBAClK,CAAC;gBACD,OAAO,IAAI,YAAY,GAAG,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,8DAA8D,aAAa,CAAC,cAAc,mCAAmC,CAAC,CAAC;YAC9I,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,iCAAiC,YAAY,mEAAmE,CAAC,CAAC;YACjI,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;gBACnH,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC;oBACtC,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,kBAAkB,CAAC,CAAC;oBACvE,OAAO,OAAO,GAAG,EAAE,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,yBAAyB,GAAG,kCAAkC,aAAa,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC/G,CAAC;gBACD,kCAAkC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpG,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,eAAe,GAA4C,IAAI,CAAC;IAEpE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,GAAG,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/G,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,EAAE,CAAC;oBACX,uCAAuC;oBACvC,IAAI,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1D,OAAO,GAAG,CAAC;oBACb,CAAC;oBACD,iDAAiD;oBACjD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,GAAG,CAAC;wBAClB,eAAe,GAAG,MAAM,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,8BAA8B,aAAa,CAAC,cAAc,IAAI,CAAC,CAAC;YACvG,CAAC;YACD,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,2EAA2E,CAAC,CAAC;QACzK,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QAChH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;AAC1I,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,OAAO;QACL,SAAS;QACT,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACvB,CAAC;AACJ,CAAC"}

package/ccw/dist/utils/shell-escape.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Windows cmd.exe argument escaping for spawn({ shell: true }).
+ *
+ * This utility escapes cmd.exe metacharacters using caret (^) so that user
+ * controlled input cannot inject additional commands.
+ */
+export declare function escapeWindowsArg(arg: string): string;
+//# sourceMappingURL=shell-escape.d.ts.map

package/ccw/dist/utils/shell-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.d.ts","sourceRoot":"","sources":["../../src/utils/shell-escape.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmBpD"}

package/ccw/dist/utils/shell-escape.js

@@ -0,0 +1,24 @@
+/**
+ * Windows cmd.exe argument escaping for spawn({ shell: true }).
+ *
+ * This utility escapes cmd.exe metacharacters using caret (^) so that user
+ * controlled input cannot inject additional commands.
+ */
+const WINDOWS_METACHARS = /[&|<>()%!"]/g;
+export function escapeWindowsArg(arg) {
+    if (arg === '')
+        return '""';
+    // Normalize newlines to spaces to prevent cmd.exe from
+    // misinterpreting multiline arguments (breaks argument parsing)
+    let sanitizedArg = arg.replace(/\r?\n/g, ' ');
+    // Escape caret first to avoid double-escaping when prefixing other metachars.
+    let escaped = sanitizedArg.replace(/\^/g, '^^');
+    // Escape cmd.exe metacharacters with caret.
+    escaped = escaped.replace(WINDOWS_METACHARS, '^$&');
+    // Wrap whitespace-containing args in double quotes.
+    if (/\s/.test(escaped)) {
+        escaped = `"${escaped}"`;
+    }
+    return escaped;
+}
+//# sourceMappingURL=shell-escape.js.map

package/ccw/dist/utils/shell-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.js","sourceRoot":"","sources":["../../src/utils/shell-escape.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5B,uDAAuD;IACvD,gEAAgE;IAChE,IAAI,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9C,8EAA8E;IAC9E,IAAI,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEhD,4CAA4C;IAC5C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAEpD,oDAAoD;IACpD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;IAC3B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/ccw/dist/utils/uv-manager.d.ts

@@ -0,0 +1,167 @@
+/**
+ * UV Package Manager Tool
+ * Provides unified UV (https://github.com/astral-sh/uv) tool management capabilities
+ *
+ * Features:
+ * - Cross-platform UV binary discovery and installation
+ * - Virtual environment creation and management
+ * - Python dependency installation with UV's fast resolver
+ * - Support for local project installs with extras
+ */
+/**
+ * Configuration for UvManager
+ */
+export interface UvManagerConfig {
+    /** Path to the virtual environment directory */
+    venvPath: string;
+    /** Python version requirement (e.g., ">=3.10", "3.11") */
+    pythonVersion?: string;
+}
+/**
+ * Result of UV operations
+ */
+export interface UvInstallResult {
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Error message if operation failed */
+    error?: string;
+    /** Duration of the operation in milliseconds */
+    duration?: number;
+}
+/**
+ * Get the path to the UV binary
+ * Search order:
+ * 1. CCW_UV_PATH environment variable
+ * 2. Project vendor/uv/ directory
+ * 3. User local directories (~/.local/bin, ~/.cargo/bin)
+ * 4. System PATH
+ *
+ * @returns Path to the UV binary
+ */
+export declare function getUvBinaryPath(): string;
+/**
+ * Check if UV is available and working
+ * @returns True if UV is installed and functional
+ */
+export declare function isUvAvailable(): Promise<boolean>;
+/**
+ * Get UV version string
+ * @returns UV version or null if not available
+ */
+export declare function getUvVersion(): Promise<string | null>;
+/**
+ * Download and install UV using the official installation script
+ * @returns True if installation succeeded
+ */
+export declare function ensureUvInstalled(): Promise<boolean>;
+/**
+ * UvManager class for virtual environment and package management
+ */
+export declare class UvManager {
+    private readonly venvPath;
+    private readonly pythonVersion?;
+    /**
+     * Create a new UvManager instance
+     * @param config - Configuration options
+     */
+    constructor(config: UvManagerConfig);
+    /**
+     * Get the path to the Python executable inside the virtual environment
+     * @returns Path to the Python executable
+     */
+    getVenvPython(): string;
+    /**
+     * Get the path to pip inside the virtual environment
+     * @returns Path to the pip executable
+     */
+    getVenvPip(): string;
+    /**
+     * Check if the virtual environment exists and is valid
+     * @returns True if the venv exists and has a working Python
+     */
+    isVenvValid(): boolean;
+    /**
+     * Create a virtual environment using UV
+     * @returns Installation result
+     */
+    createVenv(): Promise<UvInstallResult>;
+    /**
+     * Install packages from a local project with optional extras
+     * Uses `uv pip install -e` for editable installs
+     * @param projectPath - Path to the project directory (must contain pyproject.toml or setup.py)
+     * @param extras - Optional array of extras to install (e.g., ['semantic', 'dev'])
+     * @returns Installation result
+     */
+    installFromProject(projectPath: string, extras?: string[]): Promise<UvInstallResult>;
+    /**
+     * Install a list of packages
+     * @param packages - Array of package specifiers (e.g., ['numpy>=1.24', 'requests'])
+     * @returns Installation result
+     */
+    install(packages: string[]): Promise<UvInstallResult>;
+    /**
+     * Uninstall packages
+     * @param packages - Array of package names to uninstall
+     * @returns Uninstall result
+     */
+    uninstall(packages: string[]): Promise<UvInstallResult>;
+    /**
+     * Sync dependencies from a requirements file or pyproject.toml
+     * Uses `uv pip sync` for deterministic installs
+     * @param requirementsPath - Path to requirements.txt or pyproject.toml
+     * @returns Sync result
+     */
+    sync(requirementsPath: string): Promise<UvInstallResult>;
+    /**
+     * List installed packages in the virtual environment
+     * @returns List of installed packages or null on error
+     */
+    list(): Promise<{
+        name: string;
+        version: string;
+    }[] | null>;
+    /**
+     * Check if a specific package is installed
+     * @param packageName - Name of the package to check
+     * @returns True if the package is installed
+     */
+    isPackageInstalled(packageName: string): Promise<boolean>;
+    /**
+     * Run a Python command in the virtual environment
+     * @param args - Arguments to pass to Python
+     * @param options - Spawn options
+     * @returns Result with stdout/stderr
+     */
+    runPython(args: string[], options?: {
+        timeout?: number;
+        cwd?: string;
+    }): Promise<{
+        success: boolean;
+        stdout: string;
+        stderr: string;
+    }>;
+    /**
+     * Get Python version in the virtual environment
+     * @returns Python version string or null
+     */
+    getPythonVersion(): Promise<string | null>;
+    /**
+     * Delete the virtual environment
+     * @returns True if deletion succeeded
+     */
+    deleteVenv(): Promise<boolean>;
+}
+/**
+ * Create a UvManager with default settings for CodexLens
+ * @param dataDir - Base data directory (defaults to ~/.codexlens)
+ * @returns Configured UvManager instance
+ */
+export declare function createCodexLensUvManager(dataDir?: string): UvManager;
+/**
+ * Quick bootstrap function: ensure UV is installed and create a venv
+ * @param venvPath - Path to the virtual environment
+ * @param pythonVersion - Optional Python version constraint
+ * @returns Installation result
+ */
+export declare function bootstrapUvVenv(venvPath: string, pythonVersion?: string): Promise<UvInstallResult>;
+//# sourceMappingURL=uv-manager.d.ts.map

package/ccw/dist/utils/uv-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uv-manager.d.ts","sourceRoot":"","sources":["../../src/utils/uv-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,CA2DxC;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAqBtD;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC3D;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CA0C1D;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IAExC;;;OAGG;gBACS,MAAM,EAAE,eAAe;IAKnC;;;OAGG;IACH,aAAa,IAAI,MAAM;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;IAKpB;;;OAGG;IACH,WAAW,IAAI,OAAO;IAKtB;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC;IAuE5C;;;;;;OAMG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IAmE1F;;;;OAIG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IA2D3D;;;;OAIG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IA2D7D;;;;;OAKG;IACG,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuD9D;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI,CAAC;IA8CjE;;;;OAIG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAY/D;;;;;OAKG;IACG,SAAS,CACb,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/C,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmChE;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShD;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;CAerC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAU1B"}